Link. “When an email is forwarded, the position of the original email in the DOM usually changes, allowing for CSS rules to be selectively applied only when an email has been forwarded.”

CSS rewrites benign email into malware vector.